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We present a two-party protocol for quantum gambling, a new task closely related to coin tossing. 
The protocol allows two remote parties to play a gambling game, such that in a certain limit it 
becomes a fair game. No unconditionally secure classical method is known to accomplish this task. 
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Quantum cryptography is a ficld which combines quan- 
tum theory with information theory. The goal of this field 
is to use the laws of physics to provide secure informa- 
tion exchange, in contrast to classical methods based on 
(unproven) complexity assumptions. In particular, quan- 
tum key distribution protocols Q became especially im- 
portant due to technological advances which allow their 
implementation in the laboratory. However, the last im- 
portant theoretical result in the field was of a negative 
character: Mayers 0] and Lo and Chau || showed that 
quantum bit commitment is not secure. Their work also 
raised serious doubts on the possibility of obtaining any 
secure two-party protocol, such as oblivious transfer and 
coin tossing p|. In this Letter we present a secure two- 
party quantum cryptographic task - quantum gambling, 
which has no classical counterpart. 

Coin tossing is defined as a method of generating a ran- 
dom bit over a communication channel between two dis- 
tant parties. The parties, traditionally named Alice and 
Bob, do not trust each other, or a third party. They cre- 
ate the random bit by exchanging quantum and classical 
information. At the end of the protocol the generated bit 
is known to both of them. If a party cheats, i.e. changes 
the occurrence probability of an outcome, the other party 
should be able to detect the cheating. We would consider 
a coin tossing protocol to be secure if it defines a param- 
eter such that when it goes to infinity the probability to 
detect any finite change of probabilities goes to 1. Using 
a secure protocol the parties can make certain decisions 
depending on the value of the random bit, without being 
afraid that the opponent may have some advantage. For 
instance, Alice and Bob can play a game in which Alice 
wins if the outcome is '0' and Bob wins if it is T'. Note 
that if bit commitment were secure, it could be used to 
implcmcnt coin tossing trivially: Alice commits a bit a 
to Bob; Bob telis Alice the value of a bit ò; the random 
bit is the parity bit of a and b. 

It is not known today if a secure quantum coin tossing 
protocol can be found 0] . It is only known that ideal coin 
tossing, i.e. in which no party can change the expected 
distribution of the outcomes, is impossible M. Based on 



our efforts in this direction, we are skeptical about the 
possibility to have secure (non-ideal) coin tossing. Never- 
theless, we were able to construct a protocol which gives 
a solution to a closely related task. "Quantum gambling" 
is very close to playing in a casino located in a remote 
site, such as gambling over the Internet. As in a real 
casino, for instance when playing Roulette, the player's 
possible choices give him some probability to win twice 
the amount of his bet, or a smaller probability to win 
a bigger sum. However, in our protocol the player has 
only a partial control over these choices. In spite of its 
limitations our protocol provides a quantum solution to 
a useful task, which cannot be performed securely today 
in the classical framework. Assuming ideal apparata and 
communication channels, the protocol is unconditionally 
secure, depending solely on the laws of physics. 

Let us start by defining exactly the gambling task con- 
sidered here. The casino (Alice) and the player (Bob) are 
physically separated, communicating via quantum and 
classical channels. The bet of Bob in a single game is 
taken for simplicity to be 1 coin. At the end of a game 
the player wins 1 or i? coins, or loses 1 coin (his bet), 
depending on the result of the game. We have found 
a protocol which implement this game while respecting 
two requirements: First, the player can ensure that, ir- 
respective of what the casino does, his expected gain is 
not less than 5 coins, where 5 is a negative function of 
R which goes to zero when R goes to infinity. The exact 
form of 6(R) will be specified below. Second, the casino 
can ensure that, irrespective of what the player does, its 
expected gain is not less than coins. 

In order to define the protocol rigorously, we will first 
present the rules of the game, then the strategies of the 
players which ensure the outcomes quoted above and fi- 
nally we will prové the security of the method. 

The Rules of the Game: Alice has two boxes, A 
and B, which can store a particle. The quantum states 
of the particle in the boxes are denoted by \a) and |6), re- 
spectively. Alice prepares the particle in some state and 
sends box B to Bob. 

Bob wins in onc of the two cases: 
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1. If he finds the particle in box B, then Alice pays 
him 1 coin (after checking that box A is empty). 

2. If he asks Alice to send him box A for verification 
and he finds that she initially prepared a state dif- 
ferent from 

\ih) = ^= + \b)), (1) 

then Alice pays him R coins. 

In any other case Alice wins, and Bob pays her 1 coin. 

The players' strategies which ensure (independently) 
an expectation value of Alice's gain Ga > (irrespective 
of Bob's actions) and an expectation value of Bob's gain 
Gb > 5 (irrespective of Alice's actions) are as follows: 
Alice's Strategy: Alice prepares the equally dis- 
tributed state \tpo) (given in eq.(Q)). 
Bob's Strategy: After receiving box B, Bob splits the 
particle in two parts; specifically, he performs the follow- 
ing unitary operation: 

\b)->y/ï=ïj\b)+y/fj\tf), (2) 

where (b'\b) — 0. The particular splitting parameter 77 he 
uses is r) = fj(R) (to be specified below). After the split- 
ting Bob measures the projection operator on the state 
|ò), and then 

I. If the measurement yields a positive result, i.e. he 
finds the particle, he announces Alice that he won. 

II. If the measurement yields a negative result, he asks 
Alice for box A and verifies the preparation. 

This completes the formal definition of our protocol. 

In order to prové the security of the scheme, we will an- 
alyze the average gain of each party as a result of her/his 
spccific strategy. It is straightforward to see that Alice's 
strategy ensures Ga > 0. If Alice prepares the state \tpo), 
Bob has no meaningful way of increasing his odds beyond 
50%: if he decides to open box B he has a probability of 
0.5 to win 1 coin and a probability of 0.5 to lose 1 coin. 
He cannot cheat by claiming that he found the particle 
when he did not, since Alice learns the result by opening 
box A. If, instead, he decides to verify the preparation 
he will find the expected state, so he will lose 1 coin. 
Therefore G_b < 0, and since this is a zero-sum game, 
Alice's gain is Ga > 0, whatever Bob does. 

Now we will prové that Bob, using the splitting param- 
eter r/ = fj, can ensure Gb > 5. The vàlues of fj and S are 
determined by the calculation of Bob's expected gain, 
Gb- Bob tries to maximizc Gb under the assumption 
that Alice uses the worse strategy for him, namely the 
one which minimizes Gb for Bob's particular strategy. 
Therefore, we will first minimize the function Gb for any 
r], and then we will find the maximum of the obtained 



function, with that computing 5. We will also compute 
the value of r\ at the peak, fj, which will be the chosen 
splitting parameter of Bob. 

Let us first write down the expression for Gb ■ Bob gets 
1 coin if he detects the state |6); denote the probability 
for this event to occur by p,. He gets R coins if he detects 
a different preparation than \ipo) (after failing to find the 
state |6), an event with a related probability of 1 — P&); 
denote the probability to detect a different preparation 
by Pd- He loses 1 coin if he does not detect a different 
preparation than \ipo) (after failing to find \b)); the prob- 
ability for this event is (1 — Pd). Thus, the expectation 
value of Bob's gain is 

G B = Pb + (1 - Pb) [PdR - (1 - Pd)]- (3) 

For the calculations of P& and Pd we will consider the 
most general state Alice can prepare. In this case the 
particle may be located not only in boxes A and B, but 
also in other boxes C,*. The states |a), \b) and |cf) are 
mutually orthogonal. She can also correlate the particle 
to an ancilla |$), such that the most general preparation 
is 

|*„) = a\a)\$ a ) +P\b)\*b) +X>l Cí >l^>' ( 4 ) 

i 

where |$ a ), \&b), \®cí) are the states of the ancilla and 
M 2 + W + Ei N 2 * = 1- Alt er Bob splits as de- 
scribed by eq.(g), the state changes to 

i^o = o| )i$ ) + p(yï=ï \b) + \b')) |4 6 ) 

+ 5>ki>|3c 1 >. (5) 

i 

The probability to find the state \b) (in step I. of Bob's 
strategy) is 

P 6 HK&l*i>ll 2 = l/3| 2 (!-*?)• (6) 
If Bob does not find then the state reduces to 

l* 2 ) =M^a\a)\^ a )+f3^\b')\<P b )+J2^h)\^c i ?j , 

(7) 

where Aí is the normalization factor given by J\f = 
(l - (1 - rj) \(3\ 2 ) . On the other hand, if Alice pre- 
pares the state |^o) instead of |*o), then at this stage 
the particle is in the state 

V i + v y i + t) 

Thus, the best verification measurement of Bob is to 
make a projection measurement on this state. If the out- 
come is negative, Bob knows with certainty that Alice did 
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not prepared the state \ipo). The probability of detecting 
such a different preparation is given by 



Pd = i-||(^2|* 2 )|| 5 



l-M 2 



In order to calculate the minimal gain of Bob, 6, irre- 
spective of the particular strategy of Alice, we will first 
minimize Gb for e and then maximize the result for 77: 



fa 



s/T+v' 



(9) 



5(R) = Max n [Min c Gb{R, T], e)]- 
The calculations yield 

1 



(16) 



<S = — 



1 + JP + 2 - VW+ 2 ) 2 - 1 



P- V(^ + 2) 2 - 1 



l-yJR+2- y/(R + 2) 2 - 1 



Since Alice wants to minimize Gb, she tries to min- 
imize both Pf, and Pd. From eq.(||) we see that in or- 
der to minimize Pd, the states of the ancilla |$ Q ) and 
have to be identical (up to some arbitrary phase), 
i.e. |(«& |«&j,)| = 1. That is, Alice gets no advantage 
using an ancilla, so it can be eliminated. Then, in or- 
der to maximize J\í\a + (3rj\, Alice should set all 7* to 
zero, as it is clear from the normalization constraint 
\a\ 2 + |/3| 2 = 1 - J2i I Ti 1 2 - This operation has no conflict obtained for Bob's splitting parameter 
with the minimization of p,, since eq. (^|) contains only 
|/3|. Also, the maximization is possible if the coeficients 
a and /3, if seen as vectors in the complex space, point 
in the same direction. Therefore, Alice gains nothing by 
taking a and [3 to be complex numbers; it is sufhcient to 
use real positive coefhcients. Taking all these consider- 
ations into account, the state prepared by Alice can be 
simplified to 
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IV'Ó) = Vi + e |a> + V2 _e |6> - (10) 

Now, the state after Bob splits \b) reads 

Wi) = yf+e \a) + (y/T^ \b) + VV W)) , 

(11) 

and so the probability to find |6) becomes 

P 6 = ||(%i)|| 2 = (12) 
When Bob does not find the state \b), \ifj[) reduces to 

Vl + 2e + r?(l-2e) V ' 

which in turn leads to 



Pb = i-||(^|V2>II 2 



2n (1 - y/ï - 4e 2 ) 
(1 + T]) 2 + 2e (1 - r, 2 ) ' 



(14) 



Substituting eq.(p^|) and cq.([Ï4j) in eq.(^), we find Gb 
in terms of the splitting parameter 77, the preparation 
parameter e and R: 



Gb = — 



I + 77 



2e{l-n 2 )+r t {i 1 + y/l-Ae 2 ) 



r/(l - y/l - 4e 2 ) R 



(15) 



7)= yP + 2- v/(P + 2) 2 -l. (18) 
In the range of R ^> 1, these results can be simplified to 

(19) 

(20) 

We have shown that if Bob follows the proposed strat- 
egy with 77 = fj, then his average gain is not less than 5] 
this bound converges to 0, i.e. to the limit of a fair game, 
for R — > 00. This is true for any possible strategy of Al- 
ice, therefore, the security of the protocol is established. 

To compare our scheme to a real gambling situation, 
let us consider the well-known Roulette game. A bet of 
1 coin on the red/black numbers, i.e. half of the 36 num- 
bers on the table, rewards the gambler with 1 coin once 
in 18/38 turns (on average, for a spinning wheel with 
38 slots); this gives an expected gain of about —0.053 
coins. To assure the same gain in our scheme, R = 700 
is required. Note that extremely large vàlues of R are 
practically meaninglcss, one reason being the limited to- 
tal amount of moncy in use. Nevcrthclcss, the bound on 
S is not too restrictive when looking at the first prizes of 
some lottery games: a typical value of R = 10 6 gives a 
reasonably small S of about —0.0014. 

It is also interesting to consider the case of R = 1. 
This case corresponds to coin tossing, since it has only 
two outcomes: Bob's gain is either —1 coin (stands for 
bit '0') or 1 coin (stands for bit T'). The minimal average 
gain of Bob is about —0.657, which translates to an oc- 
currence probability of bit '1' of at least 0.172 (instead of 
0.5 ideally), whatever Alice does. This is certainly not a 
good coin tossing scheme, however, no classical or quan- 
tum method is known to assure (unconditionally) any 
bound for the occurrence probability of both outcomes. 

Our analysis so far was restricted to a single instance 
of the game, but the protocol may be repeated several 
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times. After N games Bob's expected gain is Gb > NS 
and Alice's expected gain is Ga > 0. Of course, Al- 
ice may choose now a complex strategy using ancillas 
and correlations between particles/ancillas from differ- 
ent runs. In this way she may change the probability 
distribution of her winnings, but she cannot reduce the 
minimal expected gain of Bob. Indeed, our proof consid- 
ers the most general actions of Alice, so the average gain 
of Bob in each game is not less than 5, and conscqucntly, 
it is not less then NS after N games. A similar argument 
is vàlid for Bob's actions, so the average gain of Alice 
remains non-negative even after N games. In gambling 
games, in addition to the average gain, it is important 
to analyze the Standard deviation of the gain, AG. Bob 
will normally accept to play a game with a negative gain 
only if AGb ^S> | Gb | (unless he has some specific target in 
mind) . In a single application of our protocol, AG s > 1 , 
so the condition is attaincd for big enough vàlues of R 
(see eq. (^9|) ) . However, increasing the number of games 
makes the gambling less attractive to Bob: if Alice fol- 
lows the proposed strategy, \Gb\ grows as N while AGb 
grows only as y/N. Therefore, Bob should accept to play 
N times only if N < 1/S 2 ~ R. 

Another important point to consider is the possible 
"cheating" of the parties. Alice has no meaningful way 
to cheat, since she is allowed to prepare any quantum 
state and she sends no classical information to Bob. Any 
operation other than preparing IV'o); as adding ancillas 
or putting more/less than one particle in the boxes, just 
decreases her minimal gain. Bob, however, may try to 
cheat. He may claim that he detected a different prepa- 
ration than \ipo), even when his verification measurement 
does not show that. If Alice prepares the initial state \ijj' ) 
(with e > 0), she is vulnerable to this cheating attempt: 
she has no way to know if Bob is lying or not. For this 
reason Alice's proposed strategy is to prepare |^>o) every 
time, such that any cheating of Bob could be invariably 
detected. When both parties follow the proposed strate- 
gies, i.e. e = and rj — fj, the game is more fair for Bob 
than assumed in the proof: 
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For R ^> 1 we get Gs prot ~ — 1/V2Ü, which is approxi- 
mately half of the value of S calculated in eq. JÏ9| ) . 

The discussion up to this point assumed an ideal ex- 
perimental setup. In practice errors are unavoidable, of 
course, and our protocol is very sensitive to the errors 
caused by the devices used in its implementation (com- 
munication channels, detectors, etc). In the presence of 
errors, if the parties disagree about the result of a par- 
ticular run it should be canceled. If such confliets oc- 
cur more than expected based on the experimental error 
rate, it means that (at least) one party is cheating, and 
the game should be stopped. The most sensitive part to 



errors is the verification measurement of Bob, i.e. the de- 
tection of the possible deviation of the initial state from 
|^o). In the ideal case, using fj and the corresponding 
e (the worst for honest Bob), the detection probability 
is very small: Pjj « ·v/2/ü 3 , for R ^S> 1. Clearly, for a 
successful realization of the protocol, the error rate has 
to be lower than this number. Thus, in practice, the ex- 
perimental error rate will constrain the maximal possible 
value of R . 

In conclusion, we have built a simple yet effective pro- 
tocol for quantum gambling. We have proved that no 
party can increase her/his winnings beyond some limit, 
which converges to when R goes to infinity, if the oppo- 
nent follows the proposed strategy. An important aspect 
of our protocol is that it shows that secure two-party 
quantum cryptography is possible, in spite of the failure 
of quantum bit commitment. The possibility of having 
other so-called "post-cold-war applications" remains an 
open question. 
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= -G Aprot = -y/R + 2-y/(R + 2)2 - 1. (21) [5] 
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In the presence of errors an alternative strategy of Bob, 
without splitting state |6), is more emeient: Bob requests 
box A for verification randomly (at a rate optimized for 
the value of R) and measures the projection on l^o) (not 
on IV^))- Although for a given R this strategy offers him 
a lower gain (8 « -2 /y/R, for R > 1), it allows using 
a higher R for a given fidelity of the setup, since now 
Pd w 1/R. 



4 



